Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

151–160 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#151

Post by atemerev »

andersa wrote: post #59
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

What if people start asking questions where you got the million dollars from? I've never understood how those presumably illegal markets can function with such large sums involved.

You are a security researcher. Your mind is trained to find and mitigate vulnerabilities. Including the vulnerabilities in finance / tax reporting.

You'll think of something. If you can hack one system, you can hack another.

$250k fully legally and with recognition is probably a good incentive not to bother. White hats have their privileges.

Re: The Chrome VRP Panel has decided to award $250k for this report

#152

Post by tonyhart7 »

saagarjha wrote: post #145
uecker wrote: post #94

Earlier quoted context omitted.

The language is just fine. The real question is: Why do people not use a string library that abstracts this away safely?

Why does the language not make one?

because at that time, C creator didn't know thing would evolve into the future. after all computer is a new thing

Re: The Chrome VRP Panel has decided to award $250k for this report

#153

Post by msh »

gambiting wrote: post #100
socalgal2 wrote: post #85

Earlier quoted context omitted.

the first time I got a bonus that big, $240k, I thought it would be life changing. the gov took $100k in taxes. I paid off my car $20k. then when I really thought about it there wasn’t much I could do. It was not a down payment on a house in LA/SF/NYC. it was not enough to start a company and hire people. If I’d changed my life style to be like a college student and live with roommates then it might have given me 2-3…

Depends where you live. Where I'm from $240k would buy you a really nice house with lots of land, and you'd have money left over. >>won’t likely change your life. Maybe you could put a down payment on a house or pay for your kids college tho but it not the freedom I thought it would be How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing?

I guess it perspective and where you are in life plus your location in the world, I would have to pay 50% tax on it so well a down payment could be it but I would still have to affort the house.

I have a hard time seeing it as life changing for me, having a decent paying job (not silicon valley developer scale) in a expensive country. Ofc if I was having a low paying career without that many perspective my outlook might differ.

I dont live a place where you pay for your kids being in college so I cant speak for that part.

Re: The Chrome VRP Panel has decided to award $250k for this report

#154

Post by msh »

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

If you got it tax free you would run the risk of being prosecuted for tax evasion, would that really be worth it?

Re: The Chrome VRP Panel has decided to award $250k for this report

#155

Post by saagarjha »

tonyhart7 wrote: post #152
saagarjha wrote: post #145

Earlier quoted context omitted.

Why does the language not make one?

because at that time, C creator didn't know thing would evolve into the future. after all computer is a new thing

Ok, but the question asks why one isn't made today.

Re: The Chrome VRP Panel has decided to award $250k for this report

#156

Post by [deleted] »

edent wrote: post #124
NoahZuniga wrote: post #114

Earlier quoted context omitted.

> How There are companies that specialize in getting grey market bugs in important software, ie browsers and OSes. They are repwat players and have a reputation to actually pay out.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

[deleted]

Re: The Chrome VRP Panel has decided to award $250k for this report

#157

Post by heisenbit »

nevi-me wrote: post #126
edent wrote: post #124

Earlier quoted context omitted.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

And do those companies facilitate black market transactions that would be tax-free?

I would consider it a deferred tax. You pay iff you are caught by the tax man with interest (and a potential bonus of a tax free holiday in a state sponsored facility). Better arrangements may be available if you are rich enough so you can get experts to arrange your taxes being legally deferred effectively after you died.

Re: The Chrome VRP Panel has decided to award $250k for this report

#158

Post by amiga386 »

exizt88 wrote: post #121
woadwarrior01 wrote: post #82

Earlier quoted context omitted.

If only they'd use a similar rubric to rein in their CEO comp[1]. [1]: https://news.ycombinator.com/item?id=24132168

Is their CEO comp not in line with the market?

No. More than 80% of Mozilla Corp's income is a yearly payment from Google. [0]

The payment will stop immediately if Google thinks it's no longer needed, or if federal prosecutors (who have determined this payment is illegal) decide the remedy is to stop the payment. [1]

The CEO's job is simple. Say "I think we should take Google's money again this year", and then pocket several million of it. Ca-ching! What are your plans for post-Google-money? Uh uh... AI? Sell out our users to advertisers? [2] It's not looking good.

The Firefox market share continues to dwindle. The board continues to hob-nob with San Francisco socialites and "activists" and use Mozilla as a piggybank to fund their chums. [edit: removed line about Mitchell Baker as she does seem to have finally left]

[0] https://en.wikipedia.org/wiki/Mozilla_Corporation#Finances

[1] https://www.bloomberg.com/news/articles/2024-08-05/google-lo...

[2] https://news.ycombinator.com/item?id=43185909

Re: The Chrome VRP Panel has decided to award $250k for this report

#159

Post by uecker »

saagarjha wrote: post #155
tonyhart7 wrote: post #152

Earlier quoted context omitted.

because at that time, C creator didn't know thing would evolve into the future. after all computer is a new thing

Ok, but the question asks why one isn't made today.

There are many string libraries.

Re: The Chrome VRP Panel has decided to award $250k for this report

#160

Post by madeofpalk »

baobun wrote: post #131
edent wrote: post #124

Earlier quoted context omitted.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

If you need all that spelled out it's probably not a market for you. You can find some by researching. AIUI most intros are via personal connections. I'd be wary of the potential ethical implications. There is more than money to life.

Which, basically, is their whole point.
Post reply on HN